Closed Bug 5897 Opened 26 years ago Closed 26 years ago

Browser terminates when submitting a form

Categories

(Core :: Layout, defect, P3)

Product:
Core
Component:
Layout
Platform:
x86
Windows NT
Type:
defect

Tracking

()

Status:
VERIFIED WORKSFORME

People

(Reporter: morse, Assigned: nisheeth_mozilla)

References

Details

Submit the following form from a file url and the browser appears to crashes. From a network url it works fine. <html> <body> <form method=POST > <input type="text"> Click here<input type="submit" value="crash"> </form> </body> </html> Now the crash is really only an assertion failure but if you try to continue execution from that point you get another crash. If you continue from that second crash, the browser terminates. The stack traces for both crashes are shown below: This of course was done with a debug build. Although I haven't tried it, I would assume that a release build would simply terminate. FIRST CRASH: NTDLL! 77f76148() net_check_file_type(_ActiveEntry * 0x012be460) line 281 + 20 bytes net_ProcessFile(_ActiveEntry * 0x012be460) line 1291 + 9 bytes net_FileLoad(_ActiveEntry * 0x012be460) line 1273 + 9 bytes NET_GetURL(URL_Struct_ * 0x0260ec20, int 102, MWContext_ * 0x012beda0, void (URL_Struct_ *, int, MWContext_ *)* 0x00412f2c bam_exit_routine(URL_Struct_ *, int, MWContext_ *)) line 2979 + 12 bytes nsNetlibService::OpenStream(nsNetlibService * const 0x00fb42b0, nsIURL * 0x012bdf60, nsIStreamListener * 0x012bbf10) line 476 + 20 bytes nsDocumentBindInfo::Bind(nsIURL * 0x012bdf60, nsIStreamListener * 0x00000000) line 1835 + 23 bytes nsDocumentBindInfo::Bind(const nsString & {...}, nsIPostData * 0x012cd8c0, nsIStreamListener * 0x00000000) line 1798 + 16 bytes nsDocLoaderImpl::LoadDocument(nsDocLoaderImpl * const 0x012ba250, const nsString & {...}, char * 0x01c2bacc, nsIContentViewerContainer * 0x012b9510, nsIPostData * 0x012cd8c0, nsISupports * 0x00000000, nsIStreamObserver * 0x012b9f20, nsURLReloadType nsURLReload, const unsigned int 0) line 1103 + 21 bytes nsWebShell::DoLoadURL(const nsString & {...}, char * 0x01c2bacc, nsIPostData * 0x012cd8c0, nsURLReloadType nsURLReload, const unsigned int 0) line 1535 nsWebShell::LoadURL(nsWebShell * const 0x012b9510, unsigned short * 0x012e08a0, char * 0x01c2bacc, nsIPostData * 0x012cd8c0, int 1, nsURLReloadType nsURLReload, const unsigned int 0) line 1616 + 28 bytes nsWebShell::LoadURL(nsWebShell * const 0x012b9510, unsigned short * 0x012e08a0, nsIPostData * 0x012cd8c0, int 1, nsURLReloadType nsURLReload, const unsigned int 0) line 1463 nsWebShell::HandleLinkClickEvent(nsIContent * 0x0126a2a0, nsLinkVerb eLinkVerb_Replace, unsigned short * 0x012e08a0, unsigned short * 0x002c1148, nsIPostData * 0x012cd8c0) line 2100 OnLinkClickEvent::HandleEvent() line 1934 HandlePLEvent(OnLinkClickEvent * 0x012ce6a0) line 1947 PL_HandleEvent(PLEvent * 0x012ce6a0) line 476 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00fb0220) line 437 + 9 bytes _md_EventReceiverProc(void * 0x01540526, unsigned int 49307, unsigned int 0, long 16450080) line 799 + 9 bytes USER32 SECOND CRASH: MSVCRTD! 1020a993() MSVCRTD! 1020fe9a() PR_Assert(char * 0x004a6160, char * 0x004a6134, int 281) line 483 net_check_file_type(_ActiveEntry * 0x012be460) line 281 + 20 bytes net_ProcessFile(_ActiveEntry * 0x012be460) line 1291 + 9 bytes net_FileLoad(_ActiveEntry * 0x012be460) line 1273 + 9 bytes NET_GetURL(URL_Struct_ * 0x0260ec20, int 102, MWContext_ * 0x012beda0, void (URL_Struct_ *, int, MWContext_ *)* 0x00412f2c bam_exit_routine(URL_Struct_ *, int, MWContext_ *)) line 2979 + 12 bytes nsNetlibService::OpenStream(nsNetlibService * const 0x00fb42b0, nsIURL * 0x012bdf60, nsIStreamListener * 0x012bbf10) line 476 + 20 bytes nsDocumentBindInfo::Bind(nsIURL * 0x012bdf60, nsIStreamListener * 0x00000000) line 1835 + 23 bytes nsDocumentBindInfo::Bind(const nsString & {...}, nsIPostData * 0x012cd8c0, nsIStreamListener * 0x00000000) line 1798 + 16 bytes nsDocLoaderImpl::LoadDocument(nsDocLoaderImpl * const 0x012ba250, const nsString & {...}, char * 0x01c2bacc, nsIContentViewerContainer * 0x012b9510, nsIPostData * 0x012cd8c0, nsISupports * 0x00000000, nsIStreamObserver * 0x012b9f20, nsURLReloadType nsURLReload, const unsigned int 0) line 1103 + 21 bytes nsWebShell::DoLoadURL(const nsString & {...}, char * 0x01c2bacc, nsIPostData * 0x012cd8c0, nsURLReloadType nsURLReload, const unsigned int 0) line 1535 nsWebShell::LoadURL(nsWebShell * const 0x012b9510, unsigned short * 0x012e08a0, char * 0x01c2bacc, nsIPostData * 0x012cd8c0, int 1, nsURLReloadType nsURLReload, const unsigned int 0) line 1616 + 28 bytes nsWebShell::LoadURL(nsWebShell * const 0x012b9510, unsigned short * 0x012e08a0, nsIPostData * 0x012cd8c0, int 1, nsURLReloadType nsURLReload, const unsigned int 0) line 1463 nsWebShell::HandleLinkClickEvent(nsIContent * 0x0126a2a0, nsLinkVerb eLinkVerb_Replace, unsigned short * 0x012e08a0, unsigned short * 0x002c1148, nsIPostData * 0x012cd8c0) line 2100 OnLinkClickEvent::HandleEvent() line 1934 HandlePLEvent(OnLinkClickEvent * 0x012ce6a0) line 1947 PL_HandleEvent(PLEvent * 0x012ce6a0) line 476 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00fb0220) line 437 + 9 bytes _md_EventReceiverProc(void * 0x01540526, unsigned int 49307, unsigned int 0, long 16450080) line 799 + 9 bytes U
Assignee: nisheeth → morse
I tested this on the M5 NT apprunner build and submitting the form did not crash the browser. Steve, please verify this and close out the bug if it no longer exists. I'm assigning this back to you.
Assignee: morse → nisheeth
Sorry Nisheeth, it still crashes for me. I'm using a tip build that I pulled on 5-9. Reassigning back to you.
Status: NEW → ASSIGNED
Target Milestone: M8
This is an edge case which I'll fix for M8...
Blocks: 7530
Status: ASSIGNED → RESOLVED
Closed: 26 years ago
Resolution: --- → WORKSFORME
I just had Steve double check this off of the latest build. This must have gotten fixed by other changes. Marking worksforme.
Status: RESOLVED → VERIFIED
Using the June 23rd build (1999062308), I can't reproduce the crash using the example form.
You need to log in before you can comment on or make changes to this bug.